GHSA-q6xv-jm4v-349h

Source

https://github.com/advisories/GHSA-q6xv-jm4v-349h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-q6xv-jm4v-349h/GHSA-q6xv-jm4v-349h.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-q6xv-jm4v-349h

Aliases

CVE-2024-38527

Related

CVE-2024-38527

Published

2024-06-26T19:03:54Z

Modified

2024-06-26T21:56:14Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-site Scripting in ZenUML

Details

Summary

Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS).

Details

The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdown features, such as ** for bolded text. However, the markdown text is currently not sanitized before rendering, allowing an attacker to enter a malicious payload for the comment which leads to XSS.

https://github.com/mermaid-js/zenuml-core/blob/dcfee8cde42673c09e19401f43ad8506658c8442/src/components/DiagramFrame/SeqDiagram/MessageLayer/Block/Statement/Comment/Comment.vue#L65

PoC

// p<img onerror=alert(1) src=""/>
A->B:hi

Above is a POC diagram payload that results in an XSS.

Here is a similar POC in mermaid.live: https://mermaid.live/edit#pako:eNpNjrFuwyAQhl8F3dRK1DaQGhs1kVq1Y6duFQsylwTVgEWw1MTyuxc5S7df39399y0wRIug4IZh9qMOdU2mF-dPJAZMKaa9GTHlBZILmnYa9BQH3R4fTq8qbMDCh6TN86WhkUHQjTkM3rUoEq0Jv2Ui7CWPTPn-HUNA6icZqQwT9ZkfHfmlIwHdTTjpVC0Lsf0eVfazChMJoBa4BdUL6uGC8n7TrCGd5zCFRRnXbVjvBVNK3gJXbtSuMVYSlnFC-Kyf961UshWbmXf2-yxcf29c7WP2yrVC0

Impact

This puts existing applications that use ZenUML unsandboxed at risk of arbitrary JavaScript execution when rendering user-controlled diagrams.

Database specific

{
    "nvd_published_at": "2024-06-26T20:15:16Z",
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-26T19:03:54Z"
}

References

Affected packages

npm / @zenuml/core

Package

Name: @zenuml/core; View open source insights on deps.dev
Purl: pkg:npm/%40zenuml/core

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.23.25